- Token/exec separation restored: slices-report (runs PR-authored code:
bun install + the reconcile runner) drops to contents:read; the PR
comment moves to a NEW slices-comment job holding the write token with
ZERO repo code — no checkout, no bun, only downloaded artifacts + jq/gh.
$GITHUB_ENV/BASH_ENV persistence is job-scoped, so the split is the
boundary. The matrix-era report job had this property; the consolidation
had regressed it. Pinned by the wiring test.
- Reconcile exit captured via PIPESTATUS[0] in BOTH lanes: GitHub's default
run-step shell has no pipefail, so `$?` after `| tee` was tee's exit —
the fail-closed gate was silently fail-open. Wiring test pins it.
- PR comment: final-attempt accounting restored the dropped COST
accumulation (the dial read $0 forever), flaky passes render as the
warning they are (never as failures), and a malformed tests[] artifact
skips that file instead of aborting the whole comment under bash -e.
- Remaining mutable action tags pinned (free-tests upload-artifact,
ci-image checkout/docker trio — the image publisher holds packages:write
and feeds the secret-bearing lanes). restore-deps fallback installs
--frozen-lockfile; register-gstack-skills validates skill names before
its rm -rf.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
restore-deps: 'cp -r SRC node_modules' with an existing node_modules NESTS
the copy and leaves stale deps active — rm first. register-gstack-skills:
'ln -snf' hard-errors under set -eu when a REAL directory occupies the
gstack slot — clear a non-symlink leftover first. CI workspaces are fresh
today; a reusable composite must survive dirty reruns.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
'Fix bun temp' x3, 'Restore deps' x5, 'Seed claude interactive config' x3,
and 'Register gstack skills' x3 were byte-near-identical copies across the
legacy matrix, the sliced lane, and the periodic lane — and only the MATRIX
copy of register-skills carried the 19-line dangling-symlink + frontmatter
fail-fast loop written after a silent 'Unknown command' + 35-min-timeout
incident. Extract all four into .github/actions/ composites; the register
composite carries the verification loop (generalized over the skill list),
so the sliced and periodic lanes — the lanes that SURVIVE the matrix
deletion — now inherit the check they had silently dropped. Matrix-job
inline copies are left untouched: that job is deleted next.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
